$ cat writeup.md…
$ cat writeup.md…
ASIS CTF Quals 2026
Task: Dilithium-flavored encryption leaks high bits of <r,u> per transcript while publishing v = u + c*s — an HNP/leaky-LWE instance in a 64-coefficient secret. Solution: 70 leak equations feed a dim-135 Kannan embedding; LLL + progressive BKZ (fpylll) recovers s, the key is rederived, the archive decrypted, and the secret posted to /api/verify.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
"An encrypted archive from the sultan's laboratory has resurfaced. It is said to contain a message meant for the court alone."
A web service (Flask/gunicorn) hands out an encrypted archive secret.enc per session
(GET /download, session cookie sultan_session, up to 500 downloads per session, 20-minute
session TTL). Together with the archive, the service publishes 70 transcripts that leak the
high bits of an inner product involving the masking polynomial. The goal is to recover the
per-session secret string hidden in the archive and POST it to /api/verify (JSON
{"guess": ...}) to receive the flag. Flag format: ASIS{...}.
crypto_engine.py)Parameters: q = 8380417 (the Dilithium prime), n = 64, ell = 1, m = 70 transcripts,
t = 16 (sparsity of the challenge), b = 65000 (leak quantizer), committee size 63,
threshold 32, secret_bound = 3.
Encryption (encrypt_sultan):
...
$ grep --similar